Red Hat Ansible Automation Platform: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 20

• High 8.1
  CVE-2023-50447

  Arbitrary Code Execution in Pillow

  Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

  kubeflow-pipelines-visualization-server pillow pillow pillow Debian Ubuntu Alpine Wolfi PyPI
  Jan 19, 2024
• High 7.5
  CVE-2023-45288 Public exploit EPSS 89%

  HTTP/2 CONTINUATION flood in net/http

  An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a reques…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 4, 2024
• High 7.5
  CVE-2024-1135

  HTTP Request Smuggling in benoitc/gunicorn

  Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints…

  benoitc benoitc/gunicorn reflex gunicorn Debian Ubuntu Wolfi PyPI
  Apr 16, 2024
• High 7.5
  CVE-2024-26130

  cryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override

  cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did n…

  pyca cryptography py3-cassandra-medusa kubeflow-pipelines Debian Ubuntu Wolfi PyPI
  Feb 21, 2024
• High 7.5
  CVE-2024-30251

  Denial of service when trying to parse malformed POST requests in aiohttp

  aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and …

  aio-libs aiohttp kserve-storage-controller kserve-agent Debian Ubuntu Azure Linux Wolfi PyPI
  May 2, 2024
• High 7.5
  CVE-2024-4340

  Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

  Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

  kubeflow-pipelines-visualization-server sqlparse sqlparse sqlparse Debian Ubuntu Wolfi PyPI
  Apr 30, 2024
• Medium 6.7
  CVE-2024-28219

  Pillow buffer overflow vulnerability

  In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

  kubeflow-pipelines-visualization-server pillow pillow pillow Debian Ubuntu Alpine Wolfi PyPI
  Apr 3, 2024
• Medium 6.5
  CVE-2023-45290

  Memory exhaustion in multipart form parsing in net/textproto and net/http

  When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while readi…

  Go standard library net/textproto golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• Medium 6.5
  CVE-2024-28849

  Proxy-Authorization header kept across hosts in follow-redirects

  follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authent…

  follow-redirects follow-redirects lerna kubeflow-centraldashboard Debian Ubuntu Azure Linux Wolfi npm
  Mar 14, 2024
• Medium 6.2
  CVE-2024-3651 Public exploit

  Denial of Service via Quadratic Complexity in kjd/idna

  A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a…

  kjd kjd/idna katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jul 7, 2024
• Medium 6.1
  CVE-2024-27306

  aiohttp vulnerable to XSS on index pages for static file handling

  aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for …

  aio-libs aiohttp kserve-storage-controller py3-cassandra-medusa Debian Ubuntu Azure Linux Wolfi PyPI
  Apr 18, 2024
• Medium 5.9
  CVE-2023-49083

  cryptography vulnerable to NULL-dereference when loading PKCS7 certificates

  cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerab…

  pyca cryptography py3-cassandra-medusa mitmproxy Debian Ubuntu Azure Linux Wolfi PyPI
  Nov 29, 2023
• Medium 5.9
  CVE-2024-24783

  Verify panics on certificates with an unknown public key algorithm in crypto/x509

  Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyC…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• Medium 5.9
  CVE-2024-3772

  Regular expression denial of service in Pydantic < 2.4.0

  Regular expression denial of service in Pydanic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string.

  pydantic Pydantic pydantic pydantic Debian Ubuntu PyPI
  Apr 15, 2024
• Medium 5.6
  CVE-2024-35195

  Requests `Session` object does not verify requests after making first request with verify=False

  Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification r…

  psf requests katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  May 20, 2024
• Medium 5.5
  CVE-2023-5752

  Mercurial configuration injectable in repo revision when installing via pip

  When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial co…

  Pip maintainers pip python3 jwt-tool Debian Azure Linux Wolfi PyPI
  Oct 24, 2023
• Medium 5.4
  CVE-2024-34064 Public exploit

  Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

  Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separat…

  pallets jinja nodejs kubeflow-pipelines-visualization-server Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  May 6, 2024
• Medium 5.3
  CVE-2024-21503

  Black vulnerable to Regular Expression Denial of Service (ReDoS)

  Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input tha…

  black black black black Debian Ubuntu Alpine PyPI
  Mar 19, 2024
• Medium 5.3
  CVE-2024-27351

  Regular expression denial-of-service in Django

  In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a craft…

  python-django django python-django py3-django Debian Ubuntu Alpine Wolfi PyPI
  Mar 15, 2024
• Medium 4.9
  CVE-2024-32879

  social-auth-app-django Improper Handling of Case Sensitivity vulnerability

  Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to …

  python-social-auth social-app-django social-auth-app-django social-auth-app-django Debian Ubuntu PyPI
  Apr 24, 2024

Revision history

1. 2026-10-18 #32

   Neue Updates von openSUSE aufgenommen

2. 2026-08-31 #31

   Neue Updates von Dell aufgenommen

3. 2026-08-03 #30

   Neue Updates von openSUSE aufgenommen

4. 2025-10-19 #29

   Neue Updates von Fedora aufgenommen

5. 2025-10-01 #28

   Neue Updates von Dell aufgenommen

6. 2025-05-29 #27

   Neue Updates von Amazon aufgenommen

7. 2025-02-11 #26

   Neue Updates von Red Hat aufgenommen

8. 2025-01-07 #25

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

9. 2024-12-22 #24

   Neue Updates von Debian und SUSE aufgenommen

10. 2024-12-11 #23

    Neue Updates von Debian aufgenommen

11. 2024-11-20 #22

    Neue Updates von Red Hat aufgenommen

12. 2024-11-11 #21

    Neue Updates von Red Hat aufgenommen

13. 2024-10-24 #20

    Neue Updates von IBM aufgenommen

14. 2024-10-16 #19

    Neue Updates von Amazon aufgenommen

15. 2024-09-05 #18

    Neue Updates von Red Hat aufgenommen

16. 2024-08-20 #17

    Neue Updates von Red Hat aufgenommen

17. 2024-08-13 #16

    Neue Updates von Red Hat aufgenommen

18. 2024-08-07 #15

    Neue Updates von Gentoo aufgenommen

19. 2024-08-06 #14

    Neue Updates von Red Hat aufgenommen

20. 2024-07-24 #13

    Neue Updates von Red Hat aufgenommen

21. 2024-07-15 #12

    Neue Updates von SUSE und Rocky Enterprise Software Foundation aufgenommen

22. 2024-07-11 #11

    Neue Updates von Red Hat aufgenommen

23. 2024-07-09 #10

    Neue Updates von Red Hat aufgenommen

24. 2024-07-03 #9

    Neue Updates von Oracle Linux aufgenommen

25. 2024-07-02 #8

    Neue Updates von Red Hat und Oracle Linux aufgenommen

References

• Debian Security Advisory DLA-4000 vom 2024-12-21
  https://lists.debian.org/debian-lts-announce/2024/12/msg00022.html
• SUSE Security Update SUSE-SU-2024:4396-1 vom 2024-12-20
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/2G4X2TXZZR4PJJZP65T5QITC24ZVDLNL/
• Rocky Linux Security Advisory RLSA-2025:0012 vom 2025-01-08
  https://errata.build.resf.org/RLSA-2025:0012
• RedHat Security Advisory vom 2024-06-10
  https://access.redhat.com/errata/RHSA-2024:3781
• Red Hat Security Advisory RHSA-2024:3820 vom 2024-06-11
  https://access.redhat.com/errata/RHSA-2024:3820
• Red Hat Security Advisory RHSA-2024:3713 vom 2024-06-12
  https://access.redhat.com/errata/RHSA-2024:3713
• Red Hat Security Advisory RHSA-2024:3811 vom 2024-06-11
  https://access.redhat.com/errata/RHSA-2024:3811
• Red Hat Security Advisory RHSA-2024:3795 vom 2024-06-11
  https://access.redhat.com/errata/RHSA-2024:3795
• Oracle Linux Security Advisory ELSA-2024-3820 vom 2024-06-12
  https://linux.oracle.com/errata/ELSA-2024-3820.html
• Fedora Security Advisory FEDORA-EPEL-2024-F52B6219CA vom 2024-06-13
  https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-f52b6219ca
• Rocky Linux Security Advisory RLSA-2024:3820 vom 2024-06-14
  https://errata.build.resf.org/RLSA-2024:3820
• SUSE Security Update SUSE-SU-2024:2068-1 vom 2024-06-18
  https://lists.suse.com/pipermail/sle-security-updates/2024-June/018734.html
• SUSE Security Update SUSE-SU-2024:2182-1 vom 2024-06-24
  https://lists.suse.com/pipermail/sle-security-updates/2024-June/018806.html
• Amazon Linux Security Advisory ALAS-2024-644 vom 2024-07-02
  https://alas.aws.amazon.com/AL2023/ALAS-2024-644.html
• Amazon Linux Security Advisory ALAS-2024-645 vom 2024-07-02
  https://alas.aws.amazon.com/AL2023/ALAS-2024-645.html
• Red Hat Security Advisory RHSA-2024:4231 vom 2024-07-03
  https://access.redhat.com/errata/RHSA-2024:4231
• Red Hat Security Advisory RHSA-2024:4227 vom 2024-07-03
  https://access.redhat.com/errata/RHSA-2024:4227
• Oracle Linux Security Advisory ELSA-2024-4227 vom 2024-07-03
  https://linux.oracle.com/errata/ELSA-2024-4227.html
• Oracle Linux Security Advisory ELSA-2024-4231 vom 2024-07-03
  https://linux.oracle.com/errata/ELSA-2024-4231.html
• Red Hat Security Advisory RHSA-2024:4404 vom 2024-07-09
  https://access.redhat.com/errata/RHSA-2024:4404
• Red Hat Security Advisory RHSA-2024:4414 vom 2024-07-09
  https://access.redhat.com/errata/RHSA-2024:4414
• Red Hat Security Advisory RHSA-2024:4427 vom 2024-07-09
  https://access.redhat.com/errata/RHSA-2024:4427
• Red Hat Security Advisory RHSA-2024:4522 vom 2024-07-12
  https://access.redhat.com/errata/RHSA-2024:4522
• SUSE Security Update SUSE-SU-2024:2481-1 vom 2024-07-15
  https://lists.suse.com/pipermail/sle-security-updates/2024-July/018968.html
• SUSE Security Update SUSE-SU-2024:2481-1 vom 2024-07-15
  https://lists.suse.com/pipermail/sle-security-updates/2024-July/018973.html
• SUSE Security Update SUSE-SU-2024:2481-1 vom 2024-07-15
  https://lists.suse.com/pipermail/sle-security-updates/2024-July/018969.html
• Rocky Linux Security Advisory RLSA-2024:4227 vom 2024-07-15
  https://errata.build.resf.org/RLSA-2024:4227
• Rocky Linux Security Advisory RLSA-2024:4231 vom 2024-07-15
  https://errata.build.resf.org/RLSA-2024:4231
• Red Hat Security Advisory RHSA-2024:4616 vom 2024-07-25
  https://access.redhat.com/errata/RHSA-2024:4616
• Red Hat Security Advisory RHSA-2024:4958 vom 2024-08-07
  https://access.redhat.com/errata/RHSA-2024:4958
• Gentoo Linux Security Advisory GLSA-202408-11 vom 2024-08-07
  https://security.gentoo.org/glsa/202408-11
• Red Hat Security Advisory RHSA-2024:5107 vom 2024-08-13
  https://access.redhat.com/errata/RHSA-2024:5107
• Red Hat Security Advisory RHSA-2024:5662 vom 2024-08-21
  https://access.redhat.com/errata/RHSA-2024:5662
• Red Hat Security Advisory RHSA-2024:6428 vom 2024-09-05
  https://access.redhat.com/errata/RHSA-2024:6428
• Debian Security Advisory DSA-5828 vom 2024-12-12
  https://security-tracker.debian.org/tracker/DSA-5828-1
• Amazon Linux Security Advisory ALAS-2024-2654 vom 2024-10-16
  https://alas.aws.amazon.com/AL2/ALAS-2024-2654.html
• IBM Security Bulletin 7174016 vom 2024-10-24
  https://www.ibm.com/support/pages/node/7174016
• Red Hat Security Advisory RHSA-2024:9150 vom 2024-11-12
  https://access.redhat.com/errata/RHSA-2024:9150
• Red Hat Security Advisory RHSA-2024:9988 vom 2024-11-21
  https://access.redhat.com/errata/RHSA-2024:9988
• Red Hat Security Advisory RHSA-2024:9984 vom 2024-11-21
  https://access.redhat.com/errata/RHSA-2024:9984
• Red Hat Security Advisory RHSA-2024:9986 vom 2024-11-21
  https://access.redhat.com/errata/RHSA-2024:9986
• Red Hat Security Advisory RHSA-2025:1335 vom 2025-02-12
  https://access.redhat.com/errata/RHSA-2025:1335
• Amazon Linux Security Advisory ALAS-2025-2868 vom 2025-05-29
  https://alas.aws.amazon.com/AL2/ALAS-2025-2868.html
• Dell Security Update vom 2025-10-02
  https://www.dell.com/support/kbdoc/000376224
• Fedora Security Advisory FEDORA-2025-D2D3A5FA79 vom 2025-10-18
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-d2d3a5fa79
• openSUSE Security Update OPENSUSE-SU-2026:11424-1 vom 2026-08-03
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CIGMW3RGRRLJHCQUZ4FXHSGOU6KERIBE/
• Dell Security Advisory DSA-2026-385 vom 2026-08-31
  https://www.dell.com/support/kbdoc/de-de/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities
• openSUSE Security Update OPENSUSE-SU-2026:12043-1 vom 2026-10-16
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HXM2CGFPI2NRPCKPNOWPQ24U4GFIC5JB/